On Friday 18 September 2026, during the first week of the new school year, a 13-year-old Italian student entered a classroom at a middle school in Rome’s Centocelle district, wearing a helmet with a smartphone attached via an improvised harness. He sprayed an irritant at his teacher and stabbed her three times under the armpit with a 20-centimetre diving knife, while transmitting the attack live on Telegram to a small group. A Congolese-born classmate of the same age intervened, disarming and stopping the attacker. The Carabinieri, Italy’s national gendarmerie, arrived at the school shortly afterwards. The 66-year-old teacher sustained relatively minor injuries and was discharged from hospital with a seven-day recovery prognosis.
This act of violence bears hallmarks associated with nihilistic violent extremism (NVE) and with the most radical fringes of the True Crime Community (TCC), the heterogeneous online milieu in which perpetrators of mass killings and terrorist attacks are aestheticised, celebrated, and, at times, emulated in real life.
This Insight examines the Centocelle case, on the basis of currently available open-source information, and places it within an unusual sequence of NVE-adjacent school incidents that occurred in Italy in 2026. On 25 March, a 13-year-old in Trescore Balneario (northern Italy) stabbed his French language teacher in a school corridor while livestreaming the attack on Telegram, after publishing an English-language pre-attack text titled “The Final Solution” containing NVE-adjacent references. On 29 May, a 12-year-old in San Vito Lo Capo (southern Italy) tried to stab his technology teacher in class, wearing a helmet covered in handwritten TCC-linked references and recording the act with the intention of livestreaming it. This sequence is particularly remarkable in a country where premeditated school attacks have historically been rare. Even the most notable earlier NVE case, the 2025 arrest of a 15-year-old near Bolzano (northeastern Italy) over an alleged 764-inspired murder plot, did not directly involve a school.
The present article distinguishes, where possible, between confirmed official information, cross-checked reports, and still-unverified claims.
Preparations for the attack and their online staging
Available reporting suggests the Centocelle student planned the attack for several days, or even weeks. Furthermore, in line with NVE’s performative logic, he shared parts of the preparation online.
Specifically, in the days leading up to the event, the boy had reportedly bought at least two knives, pepper spray, a tactical-style helmet, airsoft goggles, and tactical gloves online. He had used his mother’s credit card details saved on her smartphone, without her knowledge.
Before the attack, the boy had also displayed his “outfit” online, as is common in NVE-linked acts of violence, where aesthetic staging precedes physical action. He had shown his equipment alongside a white T-shirt on which he had written “TMD” in black marker (Figure 1). These letters are likely an acronym for “Total Muslim Death” (or, in another variation, “Total Migrant Death”), previously used by white supremacists.
Figure 1: Images posted on Telegram by the Centocelle attacker before the assault: his “outfit” (left) and the pepper spray and knives (right). Source: reporting by Serena Mazzini
Despite the likely white supremacist origin of this inscription, its selection and display do not necessarily demonstrate a coherent far-right ideological orientation. Furthermore, the alleged slogan on the T-shirt, as well as some reported online messages in English targeting Black people and Muslims, does not appear consistent with the target of the violence, since the stabbed teacher is neither a Muslim nor a migrant, and has, in fact, publicly declared radical-right, anti-migration views, including support for “remigration”. This apparent incongruity might partly reflect the NVE practice of deploying extremist symbols for shock value and transgressive effect.
Similarly, the 12-year-old attacker from San Vito Lo Capo, who had displayed far-right sympathies online, had reportedly also expressed, before his attempted attack, a desire to target specific schoolmates of foreign origin in a separate act of violence.
Much like the incidents in Trescore Balneario and in San Vito Lo Capo, and numerous others across various countries, this attention to costume and staging apparently corresponds to the belief, documented in NVE research, that an individual’s aesthetics, physical appearance, and visual “kit” serve to confirm identity within online communities and can help transform violent fantasy into action.
As in other cases (including the school attack in Trescore Balneario), the Centocelle student also prepared digital materials (such as selfies using popular filters) that others later used to create celebratory “edits” of him.
On the night before the attack, the 13-year-old announced a countdown on TikTok, posting “-5 hours” (in English), following the practice of intentional “leakage” already seen in other cases of performative youth violence (including the San Vito Lo Capo incident). At around 3 a.m., he also posted short messages in English on his Telegram channel (now shut down). In particular, he announced that “the stream should be like a 9:20 italy time [sic]”, approximately the time at which the stabbing attack took place. He also wrote that he would “leave some text before stream”; however, he reportedly did not manage to write a manifesto or a specific text before the attack. Each of the visible posts on Telegram recorded only two or three views.
In addition, shortly before the assault, the 13-year-old also sent a message to 22 members of a TikTok group, reportedly named after a TCC reference: “Guys, watch the news later” (in a mix of Italian and English). The student had also arranged a private Telegram video call to live-stream the attack; this practice has a lineage running at least from the 2019 Christchurch mosque attacks to recent youth-led attacks filmed with body-worn cameras.
On the whole, the reported digital traces suggest a layered use of online platforms, combining a public TikTok profile, which reportedly had over 4,300 followers when it was taken offline after the attack, a TikTok group chat for the final announcement, and a Telegram channel and video call for a handful of viewers.
The Assault at School and Its Immediate Aftermath
After arriving late at school, the 13-year-old locked himself in a bathroom and began the Telegram video call using his smartphone; then, after removing his sweatshirt, revealing the T-shirt bearing the letters “TMD”, he placed a helmet on his head, put on tactical gloves and airsoft goggles, and pulled the pepper spray and two diving knives from his backpack. He then left the bathroom, walked through several school corridors, and entered a classroom while a lesson was underway. There, at approximately 9:20 a.m., he attacked the teacher without saying a word.
Details regarding the immediate aftermath of the attack are fragmentary and may even appear contradictory. An educational assistant told reporters that the boy was in shock, repeatedly apologised, and spoke of a plan to harm only one person and then surrender. On the other hand, according to the classmate who intervened, as the young attacker was being led away, he proudly shouted his full name to everyone present, as if he wanted to publicly claim responsibility and secure “clout” for his act of violence.
The 13-year-old was transferred to a child neuropsychiatry ward for assessment. As in other national jurisdictions, in Italy minors under the age of 14 cannot be held criminally responsible. Nevertheless, juvenile courts can impose protective or security measures (such as transfer to a supervised rehabilitative facility) under applicable legal conditions.
According to Italian media, information about the stabbing attack was also sent to the ordinary Public Prosecutor’s Office in Rome (handling cases involving adults) to examine possible instigation by third parties. Investigators reportedly identified the four accounts connected to the Telegram video call but are still seeking the real identities and roles of the people behind them.
The recording began circulating online outside the original call more than a day later, in various digital spaces, including a gore-hosting website. Media reports traced online reactions that ranged from derision of the “failed” attack to apparent intentions of emulation; they also reported interest in purchasing the footage as a digital trophy.
Several Italian media also emphasised that a circulated copy bore Cyrillic captions. This detail, however, does not establish the nationality or location of any original user: Cyrillic is a relatively recurrent aesthetic marker in these milieus, from inscriptions on Brenton Tarrant’s firearms and ammunition magazines in Christchurch, New Zealand, to the Russian-speaking school-shooter fandom. While recent research has documented Russian-speaking networks seeking to incentivise nihilistic violence in Western countries, no public evidence connects the attack in Rome to such networks, let alone to a foreign state.
Motives for the Attack
The student reportedly harboured personal resentment toward the teacher he attacked because she had assigned him remedial work; he was scheduled to take a make-up test that very Friday. The teacher later revealed that the student had perceived this measure as a personal affront.
Nevertheless, as in the case of Trescore Balneario, this school attack cannot be explained solely on the basis of that proximate personal grievance. Instead, it should be understood within a broader context of subcultural ideas, symbols, and coded practices.
According to available open-source accounts, the attacker had expressed online admiration for perpetrators of school attacks such as Adam Lanza (Sandy Hook Elementary School, USA, 2012) and Timofey K. (Moscow Oblast, Russia, 2025), as well as for perpetrators of major far-right terrorist attacks, such as Anders Behring Breivik (Oslo and Utøya, Norway, 2011) and Brenton Tarrant. In particular, there are indications that the 13-year-old had openly displayed an affiliation with the True Crime Community, like the student from San Vito Lo Capo; according to Italian media, for example, the acronym “TCC” appeared beneath the username of his main TikTok profile (now shut down), accompanied by a helmet symbol. Reportedly, this account mostly recirculated content produced by others, including graphic videos of killings and suicides and memes mocking the victims of mass shootings. Furthermore, according to unconfirmed reports, the boy’s TikTok profile contained explicit misogynistic materials and references to the incel subculture.
One investigative account further stated that, like that of the San Vito Lo Capo student, the boy’s helmet carried handwritten references to Tarrant, Breivik and Columbine attacker Dylan Klebold, alongside a runic symbol adopted by Nazism. However, this claim has not been corroborated by other sources.
The Risk of a Domestic Mimetic Chain
In the broader context of a transnational phenomenon, the Centocelle attack marks the third NVE-adjacent school assault in Italy within a span of less than six months (not to mention that the period included the three-month summer school break).
The perpetrator of the May 2026 attack in San Vito Lo Capo had drawn inspiration from the perpetrator of the March 2026 Trescore Balneario attack, even inscribing the predecessor’s surname on his helmet, forming a sort of “domestic mimetic chain”. Moreover, a user presenting as a foreign girl was in close contact with both minors and allegedly facilitated the online distribution of their content.
In the Centocelle episode, some classmates told journalists that the attacker, too, intended to emulate the streamed school attack in Trescore Balneario. However, at the time of writing, this remains merely an unconfirmed hypothesis; so far no public evidence has shown direct contact with, or explicit imitation of, either earlier attacker.
Furthermore, just four days after the Centocelle attack, on Tuesday 22 September 2026, a 14-year-old student from Lamezia Terme (southern Italy) was stopped by Carabinieri on suspicion of planning a stabbing attack on his Italian teacher, reportedly driven by anger over having failed the previous year. Carabinieri also reportedly found a knife that the 14-year-old had already hidden in a school bathroom. Based on currently available information, this alleged plot was reported by classmates who alerted an adult after the student had discussed his intentions online on Telegram. Despite a few general similarities with the Centocelle episode and the close timing, there is currently no public indication that this alleged planned attack in Lamezia Terme was linked to an NVE-related motive or directly inspired by the school attack in Rome.
A few weeks later, on 10 October 2026, Italy’s Polizia di Stato, State Police, announced that it had searched the home of a 14-year-old student in the province of Catania (southern Italy). According to the police, the boy had alluded to school massacres in messages written in Cyrillic on an unspecified social network and had appeared online with a helmet and wearable camera. In the boy’s room, investigators found clothing and accessories featuring hate-filled phrases in English and in Cyrillic as well as extremist symbols, including Nazi imagery, anti-Muslim slogans, misanthropic phrases, and apparent allusions to the 1999 Columbine massacre. They also reported seizing a helmet fitted with a camera mount, a rudimentary bulletproof vest, and handwritten notes. A scoped rifle appears to be visible in the released photograph (Figure 2), although the official police statement does not explicitly mention it. No link with the earlier Italian cases has been reported, yet the kit apparently follows a similar template.
Figure 2: Clothing and items seized by the Italian State Police at the home of the 14-year-old student in the province of Catania. Source: Polizia di Stato
Implications for Prevention and Response
The Centocelle case illustrates some of the acute challenges posed by NVE or NVE-adjacent manifestations, both online and offline.
On the web, before an NVE-linked attack occurs, aspiring perpetrators typically signal their intention to relatively small circles, sometimes providing crucial details. As in numerous other cases, the attackers in the three Italian school incidents used posts, coded slogans or acronyms, photos, and, in the Trescore Balneario case, even a brief manifesto. Automated moderation may struggle to flag these individual leakages (which might appear harmless in isolation); the goal, therefore, should be to capture and assess an entire sequence of signals in context.
The Catania case suggests that such online signals can be acted upon: according to the Italian State Police, the house search followed a report by the Rome office of its cybercrime branch, Polizia postale e per la sicurezza cibernetica. It is not publicly known whether the alert originated from an online platform, a user or proactive monitoring.
During and immediately after the attack, the main problem becomes containment. In this vein, the Global Internet Forum to Counter Terrorism (GIFCT) activated a Perpetrator Content Incident (PCI) in response to the Centocelle attack, as it had already done in the case of Trescore Balneario; on 21-22 September 2026, GIFCT member companies added “approximately 42 visually distinct items” to its hash-sharing database.
After the attack, a crucial challenge lies in countering its ‘afterlife’. As the Centocelle case illustrates, online content of this kind can appear and migrate across a variety of digital spaces, with very different moderation systems, ranging from mainstream platforms to gore-hosting websites and TCC-linked channels.
The response to this form of violent extremism, often involving very young people, of course, extends beyond the internet. The reported intervention in Lamezia Terme, for example, shows the value of peers and trusted adults: the school’s own headteacher credited classmates who had noticed “something strange” and reported it.
In this complex context, Italy still lacks a comprehensive national strategy for preventing and countering violent extremism (P/CVE), unlike many other countries. Recent cases such as the Centocelle attack and the other episodes mentioned in this article highlight the need to develop a P/CVE national strategy promptly, drawing on international best practices and lessons learned. This effort should also include referral mechanisms and school-specific programmes.
–
Dr Francesco Marone is an Associate Professor of Political Science at the University of Aosta Valley, Italy. He is also a Senior Associate Research Fellow at the Italian Institute for International Political Studies (ISPI), a Fellow at the Program on Extremism at George Washington University, and an Associate Fellow at the International Centre for Counter-Terrorism – The Hague (ICCT). His research focuses on terrorism and violent extremism.
–
Are you a tech company interested in strengthening your capacity to counter terrorist and violent extremist activity online? Apply for GIFCT membership to join over 30 other tech platforms working together to prevent terrorists and violent extremists from exploiting online platforms by leveraging technology, expertise, and cross-sector partnerships.
The views and opinions expressed in this Insight are the authors’ own and do not necessarily reflect those of GNET or any of its partners.